Fleet version: 4.64
Related to #24805
💥 Actual behavior
The current software inventory query issued by fleet is
SELECT
name AS name,
version AS version,
'' AS bundle_identifier,
'' AS extension_id,
'' AS browser,
'python_packages' AS source,
'' AS vendor,
0 AS last_opened_at,
path AS installed_path
FROM python_packages
It does not use the new functionality released in osquery 5.16
Specifically osquery/osquery#8504
🧑💻 Steps to reproduce
osquery less than 5.16.0 (this is the current version in fleet)
- Install python via pyenv.
- Use pip to install a python package (
$ pip install numpy)
- Add the host to fleet
- Refetch host vitals
- Open up software inventory and see that there are results for the host (ensure that there is no error running the osquery software queries). However, numpy should not be included.
osquery greater than or equal to 5.16.0
- Install python via pyenv.
- Use pip to install a python package (
$ pip install numpy)
- Add the host to fleet
-
- Refetch host vitals
- Open up software inventory and see that there are results for the host, see that
numpy is included.
🛠️ To fix
Change the query to
SELECT
name AS name,
version AS version,
'' AS bundle_identifier,
'' AS extension_id,
'' AS browser,
'python_packages' AS source,
'' AS vendor,
0 AS last_opened_at,
path AS installed_path
FROM cached_users CROSS JOIN python_packages USING (uid)
This query uses a new feature that was not available in previous version of osquery. Ensure that the query can automatically detect which version to use such that it does not break.
Fleet version: 4.64
Related to #24805
💥 Actual behavior
The current software inventory query issued by fleet is
It does not use the new functionality released in osquery 5.16
Specifically osquery/osquery#8504
🧑💻 Steps to reproduce
osquery less than 5.16.0 (this is the current version in fleet)
$ pip install numpy)osquery greater than or equal to 5.16.0
$ pip install numpy)numpyis included.🛠️ To fix
Change the query to
This query uses a new feature that was not available in previous version of osquery. Ensure that the query can automatically detect which version to use such that it does not break.